7

I want to remove RC4 from Google Chrome and found the commandline option --cipher-suite-blacklist. However I wasn't able to figure out what the correct notation for RC4 is. Whatever I tried so far only brought the message:

ERROR:ssl_config_service_manager_pref.cc(55)] Ignoring unrecognized or \
  unparsable cipher suite: 

Even the names listed in ssl_cipher_suite_names.cc don't work. What should I enter to remove RC4 as a cipher for SSL/TLS?

I'm working with some different versions of GNU/Linux and sometimes also with Windows. So it would be nice if the command-line argument would work under all OSes. I used the following command:

chrome --cipher-suite-blacklist=TLS_RSA_WITH_RC4_128_MD5 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=RC4 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=0xXYZ,0xUVW --ssl-version-min=tls1.1  # XYZ and UVW are some hexadecimal numbers
4
  • whats your OS? I assume you are trying commands from this page? code.google.com/p/chromium/issues/detail?id=58831 what was the exact command you entered? Jul 8, 2013 at 15:29
  • Yes, I try the commands from this page as well as the linked IANA page.
    – qbi
    Jul 8, 2013 at 19:17
  • what was your command exactly, and did you attempt to quote the argument containing the slash? Jul 8, 2013 at 19:55
  • I'm playing around with Google Chrome and also with Chromium and have to double-check if they both use the same command-line args.
    – qbi
    Jul 8, 2013 at 20:40

3 Answers 3

11

You must inform the ciphers in hex based in RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt).

The correct command line is:

 chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011

No spaces between comma.

2
  • 1
    This works, but I don't see from your link and answer how you decided to add the (necessary) option 0xc011. Could you please enlighten me? Oct 21, 2013 at 15:39
  • 2
    @gentmatt See iana.org/assignments/tls-parameters/… for a list of all cipher suites. You can ignore the anonymous, export, PSK and KRB5 cipher suites as they are not used. 0xC011 is TLS_ECDHE_RSA_WITH_RC4_128_SHA. Missing RC4 cipher suites in this list are 0xC002,0xC007,0xC00C.
    – Lekensteyn
    Nov 9, 2013 at 8:45
2

Tiago is right.

However, there are some more ciphers You may want to block: https://www.opensource.apple.com/source/Security/Security-55163.44/libsecurity_ssl/Security/CipherSuite.h?txt

Consequently, you should try this command line:

chrome --cipher-suite-blacklist=0x0001,0x0002,0x0004,0x0005,0x0017,0x0018,0xc002,0xc007,0xc00c,0xc011,0xc016,0xff80,0xff81,0xff82,0xff83

It should block all ciphers using RC4 and/or MD5.

1

TL;DR

You need to add the following parameter to block all RC4 ciphers (as of Chrome 31 in Ubuntu 12.04 with NSS 3.15)

--cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007

General Answer to figure it out yourself

The regularly updated list of all ciphers by IANA which user @Lekensteyn posted is already very helpful and definitely better than skimming some .txt files, but I have found an even easier way to...

  • check what ciphers your browser supports
  • get the hexadecimal value of the supported ciphers

Both information is provided directly in your browser by visiting the following website of the Leibniz University of Hannover:

In the picture below, the cipher indentifiers on are on the left side of the table. So, if I wanted to block the two ciphers RSA-AES-128-GCM-SHA256 and RSA-AES256-SHA I would look for (00,9c) and (00,35).

For Google Chrome this means that I have to add the parameter1:

--cipher-suite-blacklist=0x009c,0x0035 

enter image description here

__

1- In Google Chrome on Ubuntu you have to edit the file /usr/share/applications/google-chrome.desktop and add the parameter to each line that starts with Exec=/usr/bin/google-chrome-stable. There should be three overall.

Exec=/usr/bin/google-chrome-stable --cipher-suite-blacklist=0x009c,0x0035

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .